We are able to reproduce an apparent hang condition on bootup 
running a 6.x kernel.  Under closer examination, it turns out
to be an infinite loop in the file system locking code
underneath syslog.

We believe this is a race condition between revoke() and open(). 
The getty process is doing revoke("/dev/ttyd0") and syslogd 
is doing open of "/dev/console".  The serial port /dev/ttyd0 
or COM0 is used as console.  The race condition is causing 
syslogd to get into a loop inside the kernel.  Due to this
behavior, the system does not complete the bootup & never
offers a login: prompt on the console.

We have no customizations in this area of the baseline.  We
have reviewed the code from 6.x up to HEAD and are not able
to locate any fix for this issue.  The problem is intermittent
and so far we are only able to reproduce the issue on 
one or two machines with 1GB of memory, other systems
do not show the issue.

Does anyone recognize a possible fix or have illuminating
insights into this issue?

Some additional background info follows.

Thanks,

Chitti Nimmagadda
Engineer

Dorr H. Clark
Advisor

Graduate School of Engineering
Santa Clara University
Santa Clara, CA.

Here is a test program which can reproduce the issue:

#include <stdio.h>
#include <fcntl.h>

/* Test case to reproduce the race condition on machines using serial console */

main()
{
	if (fork() == 0) {
		/* Child */
		daemon(0,0);
		while (1) {
			revoke("/dev/ttyd0");
		}
	} else {
		daemon(0,0);
		while (1) {
			int fd;
			fd = open("/dev/console", O_WRONLY);
			close(fd);
		}
	}
	
}

Here are a couple of KDB backtraces which show the loop.
Note that pid 162 in both cases is syslogd at startup:

Stopped at      kdb_enter+0x30: leave
db> bt
Tracing pid 162 tid 100061 td 0xcdad8480
kdb_enter() at kdb_enter+0x30
...
Xapic_isr1() at Xapic_isr1+0x33
vop_stdlock() at vop_stdlock+0x30
vn_lock() at vn_lock+0x132
vget() at vget+0xee
devfs_allocv() at devfs_allocv+0x1a7
devfs_lookupx() at devfs_lookupx+0x641
devfs_lookup() at devfs_lookup+0x77
VOP_LOOKUP_APV() at VOP_LOOKUP_APV+0x44
lookup() at lookup+0x54a
namei() at namei+0x460
vn_open_cred() at vn_open_cred+0x303
vn_open() at vn_open+0x33
cn_devopen() at cn_devopen+0xf3
cnopen() at cnopen+0x4c
giant_open() at giant_open+0x72
devfs_open() at devfs_open+0x276
VOP_OPEN_APV() at VOP_OPEN_APV+0x3a
vn_open_cred() at vn_open_cred+0x492
vn_open() at vn_open+0x33
kern_open() at kern_open+0x32c
open() at open+0x36
syscall() at syscall+0x34f
...

2nd box backtrace is here:

db> bt
Tracing pid 162 tid 100057 td 0xcdad8a80
kdb_enter() at kdb_enter+0x30
...
Xapic_isr1() at Xapic_isr1+0x33
lockmgr() at lockmgr+0x45
vop_stdunlock() at vop_stdunlock+0x32
VOP_UNLOCK_APV() at VOP_UNLOCK_APV+0x50
vn_lock() at vn_lock+0x173
vget() at vget+0xee
devfs_allocv() at devfs_allocv+0x1a7
devfs_lookupx() at devfs_lookupx+0x641
devfs_lookup() at devfs_lookup+0x77
VOP_LOOKUP_APV() at VOP_LOOKUP_APV+0x44
lookup() at lookup+0x54a
namei() at namei+0x460
vn_open_cred() at vn_open_cred+0x303
vn_open() at vn_open+0x33
cn_devopen() at cn_devopen+0xf3
cnopen() at cnopen+0x4c
giant_open() at giant_open+0x72
devfs_open() at devfs_open+0x276
VOP_OPEN_APV() at VOP_OPEN_APV+0x3a
vn_open_cred() at vn_open_cred+0x492
vn_open() at vn_open+0x33
kern_open() at kern_open+0x32c
open() at open+0x36
syscall() at syscall+0x34f
...

http://www.cse.scu.edu/~dclark/coen_284_FreeBSD/race_condition.txt